CN104184717A - Virtual host safety protection system design - Google Patents

Abstract

The invention relates to a virtual host safety protection system. The technical scheme is that the virtual host safety protection system deploys safety nodes in each cabinet at a cloud computing center by adopting distributed deployment manner, wherein the safety nodes are deployed through a transparent mode. A safety protection assembly runs in the safety node. All the safety nodes are subjected to unified management and control through a virtual host protection management center. The beneficial effects are that all virtual machines in the cloud computing data center are provided with modularized, customized, dynamic and automatic safety protection scheme through the system.

Description

Design of a virtual host security protection system

technical field

The patent of the present invention relates to a virtual host security protection system.

Background technique

Cloud computing is a revolution in the field of information technology, an inevitable trend of the development of information technology and the inevitable result of the deep application of information technology, and it will inevitably have a major impact on information security.

In the era of electronic communication, in order to realize the confidentiality of communication, the main research content of information security technology is based on cryptography. After entering the computer age, the concept of information security has undergone new changes. Host security has become the main research goal of information security. Based on security model analysis and verification, information security products are the main components, and security domain construction is the main goal. The idea of security protection system has gradually become the mainstream.

In the era of cloud computing, computing resources, storage resources, data resources, etc. are highly shared, making them real basic resources, so that ordinary users can enjoy higher-end IT services. The innovative model of cloud computing also brings challenges and opportunities to information security. We urgently need to realize data security and privacy protection in the cloud computing environment, realize secure computing in a multi-tenant environment, and realize key technologies, standards, regulations construction, Multi-level and all-round reform of the national supervision and management system.

In the traditional network security mode, the security of the network computing environment needs to be protected layer by layer with various hardware devices, but there is a lack of coordinated protection and unified management among various security devices, and in today's cloud computing data center environment, security The granularity of protection is getting finer and finer. Different virtual machine devices carry different business requirements, and the required security protection levels and requirements are also different. This puts forward higher requirements for security management levels.

According to the characteristics of the cloud computing data center, the virtual host security protection scheme proposed in this paper changes the traditional network security protection methods and solves the security problems caused by virtualization and multi-tenancy in the cloud computing environment. Taking the integrated cabinet as the basic unit, the integrated cabinet is not only the basic unit of cloud platform deployment and operation and maintenance management, but also the basic unit of security protection. The hosts in the same cabinet belong to the same security domain; security devices are provided in the form of components, which can Continuously expand new security components according to requirements; build a security measure library based on security components, customize different security measure templates according to different types of security requirements; introduce Secaas (Security-as-a-service) "Security as a Service", Allow different tenants to enjoy personalized security services; design and develop encryption and decryption engines, key management and other security components to meet the security requirements under the cloud platform.

Contents of the invention

In order to overcome the problem that the existing cloud computing data center cannot provide targeted security protection for many virtual machine groups with specific functions in the cloud computing data center, the present invention proposes a design of a virtual machine host security protection system, thereby improving The overall security level of the cloud computing data center. The present invention adopts a distributed, multi-component, and multi-instance manner to provide a componentized, customized, dynamic, and automated security protection scheme for all virtual machines in a cloud computing data center.

The technical solution of the present invention is mainly aimed at the characteristics of the cloud computing data center. The virtual host security protection system takes "safety as a service" as the starting point, takes the virtual machine as the core, takes the virtual machine group as the unit, and adopts a distributed deployment method. Security nodes are deployed in transparent mode in each cabinet of the center. The security nodes do not affect each other and work independently. All security nodes are managed by the virtual host protection management center.

In the cloud computing environment, the users of the virtual host interact with the virtual host through network communication, and the business functions carried by the virtual host are also provided externally through network communication, so network communication becomes the main channel for the virtual host to interact with the outside world. Communication protection can guarantee the security of virtual hosts to a large extent.

The security node is composed of core functional modules such as unified security gateway, unified configuration management function, and security protection components, as shown in Figure 2. The details are as follows:

1. Unified security gateway function module

Furthermore, the main function of the above-mentioned unified security gateway is to analyze and filter network data packets.

The gateway module is mainly composed of five parts: network service, log service, data storage service, user authentication service, and network traffic management service, as shown in Figure 3. The gateway can set the network information of the system operation through the network configuration in the unified configuration management. The network information includes network card information, host name and dynamic domain name client configuration, DHCP dynamic host configuration protocol, and DNS domain name resolution. At the same time, the event log information can be viewed according to the event type or network event type through the unified configuration of various configurations of the management subsystem. When the client accesses the system, certificate authentication is required, otherwise the relevant functions cannot be seen or a certificate error message is always reported when logging in. The policy information set by the user and various application information added will be stored in the postgreSQL database.

The business process of the unified security gateway is shown in Figure 4. The unified security gateway mainly filters network data packets. The filtering process must be completed with two network cards. The network data packets flow in from the first network card eth0. The interface released by each component and connected to the unified security gateway is matched with each component. After the matching is completed in the component, the network data packets that pass are marked in one way, and those that do not pass (also called threatening) The data packet) is marked in another way, and then after the marking is completed in the component, the data packet will flow out of the component and enter the unified security gateway. The unified security gateway discards the data packet according to two different identifications And reserve operation, carry out the next operation on the non-threatening data packets, and flow out through the eth1 network card.

Further, the above-mentioned network data packet capture mechanism in the unified security gateway mainly includes three parts: one is a packet capture mechanism for a specific operating system, the other is an interface for user programs, and the third is a packet filtering mechanism.

The conventional transmission path of the data packet is the network card, the device driver layer, the data link layer, the IP layer, the transport layer, and finally reaches the application program. The packet capture mechanism is to add a bypass process at the data link layer, perform filtering/buffering and other related processing on the sent and received data packets, and finally pass them directly to the application program. It is worth noting that the packet capture mechanism does not affect the network stack processing of packets by the operating system. For the user program, the packet capture mechanism provides a unified interface, so that the user program can obtain the desired data packets simply by calling several functions. In this way, the capture mechanism for a specific operating system is transparent to the user, so that the user program has better portability. The main functions of network packets are reflected in the following aspects:

a) Use the IO control command to set the network card, and copy all the data packets in the link layer to the buffer.

b) Use high-performance network I/O under Linux to improve the performance of communication between networks.

c) For the events received by high-performance network I/O, according to the processing modules registered in the event, corresponding processing is performed respectively, and the received data packets are re-encapsulated according to their protocols to facilitate the use of data packet filtering.

Further, the above-mentioned data packet filtering is to filter the captured data packets according to the user's requirements, and finally only pass the data packets satisfying the filtering conditions to the user program.

Packet filtering technology is the most basic implementation technology of firewalls. Devices with packet filtering technology are used to control the inflow and outflow of internal and external network data. Most of the packet filtering technologies are based on the TCP/IP protocol. Check to determine whether to allow the data packet to pass according to the source address and destination address of the datagram, the port numbers of TCP and IP, and other states of TCP. Packet filtering mainly includes the following aspects:

Through Epoll high-performance network IO monitoring, all data packets in the network are collected, and all data packets are processed according to their header information.

a) Analyze the data packets received by the bypass monitor, and analyze and process them according to tcp, udp, and icmp respectively.

b) The parsed data packet is matched with the data packet filter condition, and then the processing flag of the data packet is set according to the filter condition, and the operating system kernel processes the data packet according to the processing flag.

2. Unified configuration management function module

Further, the above-mentioned unified configuration management function module is mainly composed of network configuration, management configuration, system configuration, local directory configuration and system information configuration, as shown in FIG. 5 .

In the network configuration, you can set the network information of the system running (network card information, solutions to common network problems); in the management configuration, you can add administrator account information, enable the option of external access to the system, and set the public address of the external access system, according to user input Certificate information, generate a self-signed certificate, you can enable or disable Simple Network Management Protocol (SNMP) monitoring, users can change the skin information of the system according to their preferences, or upload their favorite skin information in .zip format ;In the system configuration, you can set manual restart or manually shut down the server, set up the installation wizard, you can backup and restore individual information of the system, and you can set the protocol information of the system hypertext transfer protocol (HTTP), file transfer protocol (FTP), simple mail Transmission protocol (SMTP), mail protocol (POP3), Internet message access protocol (IMAP), in the local area configuration, you can view the current time of the server where the system is located, set the time zone and log in the language information of the system, users can also upload according to their own preferences The new language pack in .zip format can be forced to update the time of the system server so that it is the same as the current time. The local directory configuration can add user information for logging in to the VPN, and can also edit the added vpn user information (including deleting and modifying user information). In the system information configuration, you can view the current version information, license information and license agreement information of the system.

3. Safety protection components

Further, the aforementioned security protection components include a firewall component, an intrusion detection component, an intrusion prevention component, a virus threat component, and a denial of service defense component, as shown in FIG. 6 .

Further, firewall rules that need to be filtered can be added in the above-mentioned firewall component, and the added rule information can also be edited (delete and modify the rule information), and the added rule information can also be imported and exported in batches, or Event type (all active events and blocked event types), (both default rack and all racks) to view event log information.

Further, the status information of the intrusion prevention component can be viewed in the above-mentioned intrusion prevention component, and the rule information (including rules and related rule variables) that needs to be filtered by the intrusion prevention component can be added. The added rule information and the variable information corresponding to the rule can be added. Editing operations (including modifying and deleting operations), and the added batch rule information and the variable information corresponding to the rules can also be exported and imported. According to the event type (all active events and blocked events), (the default rack and all racks) to view event log information.

Further, in the above-mentioned virus threat component, the Internet information (comprising file extension and MIME type) that needs to be filtered can be set, and the related information of the file extension that needs to be filtered and the MIME type can also be added and edited (modify file extension and MIME type). MIME type information and delete file extension and MIME type information), you can set the email information that needs to be filtered, this can enable and disable scanning email protocol information (smtp simple mail transfer protocol, pop3, imap Internet message access protocol), You can set ftp information, view web event logs by web event type (infected web event type, clean web event type), and view email event types by email event type (infected email event and clean email) Mail log information.

Further, the above-mentioned denial-of-service defense component is a necessary condition for other components to view event logs. Only after the denial-of-service defense component is installed, can you view related event log information in other components. Users can view the status information of the report in the denial of service defense component, and can set the report generation time (weekly, daily) and the pre-time of report generation, and can add the email information of the user who views the report and the attachment size of the attachment Restrict information, and also set the log information to be viewed (enable and disable syslog).

The beneficial effects of the present invention are: the system provides a componentized, customized, dynamic and automatic security protection scheme for all virtual machines in the cloud computing data center.

Description of drawings

Figure 1: It is a structural diagram of the virtual host protection system.

Figure 2: Structural diagram of security protection nodes for virtual host protection.

Figure 3: Structural diagram of the unified security gateway.

Figure 4: Flowchart for the business processing of the unified security gateway.

Figure 5: A structural diagram of unified configuration management.

Figure 6: Structural diagram of the safety protection components.

Specific examples (written according to the content of the invention, the implementation of the content of the invention can be further supplemented)

The present invention will be further described in conjunction with the drawings and embodiments.

The present invention is mainly composed of core functional modules such as a unified security gateway, a unified configuration management function, and a security protection component, as shown in Figure 2, and the specific introduction is as follows:

Specifically, with reference to accompanying drawing 4, the process steps of the above-mentioned unified security gateway module are described in detail as follows:

The unified security gateway mainly filters the network data packets. In the filtering process, there must be two network cards to complete. The network data packets flow in from the first network card eth0, and are released by each component to connect with the unified security gateway. The interface and each component perform rule matching. After the matching is completed in the component, the passing network data packets are marked in one way, and the non-passing (also called threatening data packets) are marked in another way. , and then after marking in the component, the data packet will flow out from the component and enter the unified security gateway. The unified security gateway discards and retains the data packet according to two different identifications, and downloads the non-threatening data packet One-step operation, outflow through the eth1 network card.

Specifically, the above-mentioned unified configuration management function module, its specific operation steps are as follows:

In the network configuration, you can set the network information of the system running (network card information, solutions to common network problems); in the management configuration, you can add administrator account information, enable the option of external access to the system, and set the public address of the external access system, according to user input Certificate information, generate a self-signed certificate, you can enable or disable Simple Network Management Protocol (SNMP) monitoring, users can change the skin information of the system according to their preferences, or upload their favorite skin information in .zip format ;In the system configuration, you can set manual restart or manually shut down the server, set up the installation wizard, you can backup and restore individual information of the system, and you can set the protocol information of the system hypertext transfer protocol (HTTP), file transfer protocol (FTP), simple mail Transmission protocol (SMTP), mail protocol (POP3), Internet message access protocol (IMAP), in the local area configuration, you can view the current time of the server where the system is located, set the time zone and log in the language information of the system, users can also upload according to their own preferences The new language pack in .zip format can be forced to update the time of the system server so that it is the same as the current time. The local directory configuration can add user information for logging in to the VPN, and can also edit the added vpn user information (including deleting and modifying user information). In the system information configuration, you can view the current version information, license information and license agreement information of the system.

Specifically, with reference to Figure 6, the internal components of the above-mentioned unified security gateway module are described in detail as follows:

The security protection components include firewall components, intrusion detection components, intrusion prevention components, virus threat components, and denial of service defense components.

It should be noted that the above-mentioned technical features continue to be combined with each other to form various embodiments not listed above, which are all regarded as the scope of the description of the present invention; and, for those of ordinary skill in the art, improvements can be made according to the above description Or transformation, and all these improvements and transformations should belong to the protection scope of the appended claims of the present invention.

Claims (6)

1. a fictitious host computer security protection system, is characterized in that, take virtual machine cluster as unit, take distributed deployment as mode, and unified security protection is provided.

2. a fictitious host computer security protection system, is characterized in that, the fictitious host computer guard system of cloud computing data center is comprised of fictitious host computer administrative center and numerous security node.

3. a fictitious host computer security protection system, is characterized in that, security node consists of security gateway functional module, unified configuration feature module and security component.

4. a fictitious host computer security protection system, it is characterized in that, security gateway functional module is mainly served five major parts by network service, log services, data storage service, user's authentication service, network flow management and is formed, and is mainly that network packet is filtered.

5. a fictitious host computer security protection system, is characterized in that, unified configuration feature module is comprised of network configuration, administration configuration, system configuration, local directory configuration and system information configuration, and whole system is carried out to detailed configuration.

6. a fictitious host computer security protection system, it is characterized in that, safety protection component threatens assembly, denial of service defence module composition by firewall component, intrusion detection assembly, intrusion prevention assembly, virus, for all virtual machines in security node institute range of management provide security protection service.